@laioutr/app-shopware 0.15.4 → 0.16.0

package/dist/module.json

@@ -1,6 +1,6 @@
 {
   "name": "@laioutr/app-shopware",
-  "version": "0.15.4",
+  "version": "0.16.0",
   "configKey": "@laioutr/app-shopware",
   "builder": {
     "@nuxt/module-builder": "1.0.1",

package/dist/module.mjs

@@ -1,10 +1,10 @@
 import { defineNuxtModule, createResolver, addServerHandler, addPlugin, installModule } from '@nuxt/kit';
 import { defu } from 'defu';
-import { CHECKOUT_ENDPOINT_PATH, ADOPT_SESSION_ENDPOINT_PATH } from '../dist/runtime/server/const/checkout.js';
+import { CHECKOUT_ENDPOINT_PATH, ADOPT_SESSION_ENDPOINT_PATH, ORDER_HANDOFF_ENDPOINT_PATH } from '../dist/runtime/server/const/checkout.js';
 import { registerLaioutrApp } from '@laioutr-core/kit';
 
 const name = "@laioutr/app-shopware";
-const version = "0.15.4";
+const version = "0.16.0";
 
 const module$1 = defineNuxtModule({
   meta: {
@@ -36,6 +36,11 @@ const module$1 = defineNuxtModule({
       method: "post",
       handler: resolveRuntimeModule("./server/routes/adopt-session.post")
     });
+    addServerHandler({
+      route: ORDER_HANDOFF_ENDPOINT_PATH,
+      method: "post",
+      handler: resolveRuntimeModule("./server/routes/order-handoff.post")
+    });
     await registerLaioutrApp({
       name,
       version,

package/dist/runtime/app/components/ShopwareEmbedFrame.d.vue.ts

@@ -1,14 +1,24 @@
-declare const _default: import("vue").DefineComponent<{}, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {
+type __VLS_Props = {
+    /** Absolute URL of the page a completed order lands on. */
+    finishUrl?: string;
+    /** Absolute URL of this checkout page, used to re-frame a failed payment's retry. */
+    checkoutUrl?: string;
+    /** Order whose payment failed, re-framed on the storefront's order-edit page. */
+    retryOrderId?: string;
+};
+declare const _default: import("vue").DefineComponent<__VLS_Props, {
+    refreshHandoff: () => void;
+}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {
     "checkout-finish": (orderId: string) => any;
     "auth-changed": (payload: {
         from: string;
         code?: string;
     }) => any;
-}, string, import("vue").PublicProps, Readonly<{}> & Readonly<{
+}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
     "onCheckout-finish"?: ((orderId: string) => any) | undefined;
     "onAuth-changed"?: ((payload: {
         from: string;
         code?: string;
     }) => any) | undefined;
-}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 export default _default;

package/dist/runtime/app/components/ShopwareEmbedFrame.vue

@@ -1,21 +1,56 @@
 <script setup>
-import { computed, ref, useRuntimeConfig } from "#imports";
-import { CHECKOUT_ENDPOINT_PATH } from "../../shared/const/checkout";
+import { computed, onBeforeUnmount, ref, useRuntimeConfig } from "#imports";
+import {
+  CHECKOUT_CONFIRM_ROUTE,
+  CHECKOUT_ENDPOINT_PATH,
+  CHECKOUT_RETRY_ROUTE,
+  ORDER_HANDOFF_ENDPOINT_PATH,
+  RETRY_ORDER_QUERY_KEY
+} from "../../shared/const/checkout";
 import { useShopwareEmbedBridge } from "../composables/useShopwareEmbedBridge";
+import { createOrderHandoffRefresher } from "../lib/createOrderHandoffRefresher";
 const emit = defineEmits(["checkout-finish", "auth-changed"]);
+const props = defineProps({
+  finishUrl: { type: String, required: false },
+  checkoutUrl: { type: String, required: false },
+  retryOrderId: { type: String, required: false }
+});
 const storefrontOrigin = computed(() => useRuntimeConfig().public["@laioutr/app-shopware"]?.storefrontOrigin ?? "");
 const frameRef = ref(null);
 const height = ref();
 const loaded = ref(false);
+const handoff = createOrderHandoffRefresher({
+  mint: async () => {
+    try {
+      const response = await $fetch(ORDER_HANDOFF_ENDPOINT_PATH, {
+        method: "POST",
+        body: { finishUrl: props.finishUrl, checkoutUrl: props.checkoutUrl }
+      });
+      return response.code;
+    } catch {
+      return null;
+    }
+  },
+  deliver: (code) => sendOrderHandoff(code)
+});
 let hasShownFramePage = false;
-const onFramePageLoaded = () => {
+let handoffActive = false;
+const onFramePageLoaded = (payload) => {
   loaded.value = true;
+  const canReturn = Boolean(props.finishUrl) || payload.returnFallback;
+  const submitsAnOrder = payload.route === CHECKOUT_CONFIRM_ROUTE || payload.route === CHECKOUT_RETRY_ROUTE;
+  handoffActive = submitsAnOrder && canReturn;
+  if (handoffActive) {
+    handoff.start();
+  } else {
+    handoff.stop();
+  }
   if (hasShownFramePage) {
     window.scrollTo({ top: 0, left: 0 });
   }
   hasShownFramePage = true;
 };
-const { sendInit } = useShopwareEmbedBridge(frameRef, {
+const { sendInit, sendOrderHandoff } = useShopwareEmbedBridge(frameRef, {
   storefrontOrigin: storefrontOrigin.value,
   onResize: (value) => height.value = value,
   onPageLoaded: onFramePageLoaded,
@@ -23,10 +58,18 @@ const { sendInit } = useShopwareEmbedBridge(frameRef, {
   onAuthChanged: (payload) => emit("auth-changed", payload)
   // laioutr:pw-recovery is received but unused in v1.
 });
+const refreshHandoff = () => {
+  if (handoffActive) handoff.start();
+};
+defineExpose({ refreshHandoff });
+onBeforeUnmount(() => handoff.stop());
 const onFrameLoad = () => {
   loaded.value = true;
   sendInit();
 };
+const frameSrc = computed(
+  () => props.retryOrderId ? `${CHECKOUT_ENDPOINT_PATH}?${RETRY_ORDER_QUERY_KEY}=${encodeURIComponent(props.retryOrderId)}` : CHECKOUT_ENDPOINT_PATH
+);
 const frameStyle = computed(() => ({ height: height.value ? `${height.value}px` : "600px" }));
 </script>
 
@@ -42,7 +85,7 @@ const frameStyle = computed(() => ({ height: height.value ? `${height.value}px`
       </div>
       <iframe
         ref="frameRef"
-        :src="CHECKOUT_ENDPOINT_PATH"
+        :src="frameSrc"
         title="Checkout"
         class="shopware-embed-frame__iframe"
         :style="frameStyle"

package/dist/runtime/app/components/ShopwareEmbedFrame.vue.d.ts

@@ -1,14 +1,24 @@
-declare const _default: import("vue").DefineComponent<{}, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {
+type __VLS_Props = {
+    /** Absolute URL of the page a completed order lands on. */
+    finishUrl?: string;
+    /** Absolute URL of this checkout page, used to re-frame a failed payment's retry. */
+    checkoutUrl?: string;
+    /** Order whose payment failed, re-framed on the storefront's order-edit page. */
+    retryOrderId?: string;
+};
+declare const _default: import("vue").DefineComponent<__VLS_Props, {
+    refreshHandoff: () => void;
+}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {
     "checkout-finish": (orderId: string) => any;
     "auth-changed": (payload: {
         from: string;
         code?: string;
     }) => any;
-}, string, import("vue").PublicProps, Readonly<{}> & Readonly<{
+}, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
     "onCheckout-finish"?: ((orderId: string) => any) | undefined;
     "onAuth-changed"?: ((payload: {
         from: string;
         code?: string;
     }) => any) | undefined;
-}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 export default _default;

package/dist/runtime/app/composables/useShopwareEmbedBridge.d.ts

@@ -17,8 +17,10 @@ export type UseShopwareEmbedBridgeOptions = {
  *
  * Returns `sendInit` — call it on the iframe's `load` event to proactively complete the
  * handshake, since the plugin's one-shot `ready` can fire before this listener attaches
- * (the SSR iframe loads before Vue hydrates).
+ * (the SSR iframe loads before Vue hydrates) — and `sendOrderHandoff`, which hands the
+ * storefront a freshly minted code for its top-level order submit.
  */
 export declare const useShopwareEmbedBridge: (frameRef: Ref<HTMLIFrameElement | null>, options: UseShopwareEmbedBridgeOptions) => {
     sendInit: () => void;
+    sendOrderHandoff: (code: string) => void;
 };

package/dist/runtime/app/composables/useShopwareEmbedBridge.js

@@ -1,11 +1,15 @@
 import { onBeforeUnmount, onMounted } from "vue";
-import { buildInitMessage } from "../const/bridge.js";
+import {
+  buildInitMessage,
+  buildOrderHandoffMessage
+} from "../const/bridge.js";
 import { createBridgeHandler } from "../lib/createBridgeHandler.js";
 export const useShopwareEmbedBridge = (frameRef, options) => {
-  const { handleMessage, sendInit } = createBridgeHandler({
+  const { handleMessage, sendInit, sendOrderHandoff } = createBridgeHandler({
     getFrameWindow: () => frameRef.value?.contentWindow ?? null,
     storefrontOrigin: options.storefrontOrigin,
     postInit: (frameWindow, targetOrigin) => frameWindow.postMessage(buildInitMessage(), targetOrigin),
+    postOrderHandoff: (frameWindow, targetOrigin, code) => frameWindow.postMessage(buildOrderHandoffMessage(code), targetOrigin),
     onResize: options.onResize,
     onPageLoaded: options.onPageLoaded,
     onCheckoutFinish: options.onCheckoutFinish,
@@ -18,5 +22,5 @@ export const useShopwareEmbedBridge = (frameRef, options) => {
     sendInit();
   });
   onBeforeUnmount(() => window.removeEventListener("message", listener));
-  return { sendInit };
+  return { sendInit, sendOrderHandoff };
 };

package/dist/runtime/app/const/bridge.d.ts

@@ -10,6 +10,15 @@ export declare const BRIDGE_SOURCE = "laioutr-shopware";
 export declare const BRIDGE_VERSION = 1;
 /** Handshake reply this (parent) frame posts to pin the storefront origin. */
 export declare const BRIDGE_INIT_TYPE = "laioutr:init";
+/**
+ * Message this (parent) frame posts to hand the storefront a fresh single-use handoff code.
+ *
+ * The storefront's confirm form submits into the top-level window, which carries no storefront
+ * session of its own when the two sit on different registrable domains. The code travels in the
+ * form so the storefront can install one before the order is placed. Codes expire in about a
+ * minute, so this is posted repeatedly while the frame sits on the confirm page.
+ */
+export declare const BRIDGE_ORDER_HANDOFF_TYPE = "laioutr:order-handoff";
 /** Messages the storefront bridge sends to this (parent) frame. */
 export type BridgeInboundMessage = {
     type: 'laioutr:ready';
@@ -26,6 +35,8 @@ export type BridgeInboundMessage = {
         route: string | null;
         navigationId: string | null;
         salesChannelId: string | null;
+        /** Whether the storefront has a configured return URL of its own to fall back on. */
+        returnFallback: boolean;
     };
 } | {
     type: 'laioutr:checkout-finish';
@@ -61,3 +72,12 @@ export declare const buildInitMessage: () => {
     type: string;
     payload: {};
 };
+/** A freshly minted handoff code, posted to the pinned storefront origin. */
+export declare const buildOrderHandoffMessage: (code: string) => {
+    source: string;
+    version: number;
+    type: string;
+    payload: {
+        code: string;
+    };
+};

package/dist/runtime/app/const/bridge.js

@@ -1,9 +1,16 @@
 export const BRIDGE_SOURCE = "laioutr-shopware";
 export const BRIDGE_VERSION = 1;
 export const BRIDGE_INIT_TYPE = "laioutr:init";
+export const BRIDGE_ORDER_HANDOFF_TYPE = "laioutr:order-handoff";
 export const buildInitMessage = () => ({
   source: BRIDGE_SOURCE,
   version: BRIDGE_VERSION,
   type: BRIDGE_INIT_TYPE,
   payload: {}
 });
+export const buildOrderHandoffMessage = (code) => ({
+  source: BRIDGE_SOURCE,
+  version: BRIDGE_VERSION,
+  type: BRIDGE_ORDER_HANDOFF_TYPE,
+  payload: { code }
+});

package/dist/runtime/app/lib/createBridgeHandler.d.ts

@@ -12,6 +12,8 @@ export type CreateBridgeHandlerOptions = {
     storefrontOrigin: string;
     /** Post the contentless handshake reply to the (validated) origin. */
     postInit: (frameWindow: Window, targetOrigin: string) => void;
+    /** Post a freshly minted order-handoff code to the (validated) origin. */
+    postOrderHandoff: (frameWindow: Window, targetOrigin: string, code: string) => void;
     onResize?: (height: number) => void;
     onPageLoaded?: (payload: BridgePageLoadedPayload) => void;
     onCheckoutFinish?: (orderId: string) => void;
@@ -41,4 +43,5 @@ export type CreateBridgeHandlerOptions = {
 export declare const createBridgeHandler: (options: CreateBridgeHandlerOptions) => {
     handleMessage: (event: BridgeMessageEvent) => void;
     sendInit: () => void;
+    sendOrderHandoff: (code: string) => void;
 };

package/dist/runtime/app/lib/createBridgeHandler.js

@@ -7,6 +7,12 @@ export const createBridgeHandler = (options) => {
       options.postInit(frameWindow, options.storefrontOrigin);
     }
   };
+  const sendOrderHandoff = (code) => {
+    const frameWindow = options.getFrameWindow();
+    if (frameWindow && options.storefrontOrigin) {
+      options.postOrderHandoff(frameWindow, options.storefrontOrigin, code);
+    }
+  };
   const handleMessage = (event) => {
     const frameWindow = options.getFrameWindow();
     if (!frameWindow || event.source !== frameWindow) return;
@@ -36,5 +42,5 @@ export const createBridgeHandler = (options) => {
         message;
     }
   };
-  return { handleMessage, sendInit };
+  return { handleMessage, sendInit, sendOrderHandoff };
 };

package/dist/runtime/app/lib/createOrderHandoffRefresher.d.ts

@@ -0,0 +1,24 @@
+export type CreateOrderHandoffRefresherOptions = {
+    /** Mint a fresh single-use code, or resolve `null` when the mint failed. */
+    mint: () => Promise<string | null>;
+    /** Hand a freshly minted code to the storefront frame. */
+    deliver: (code: string) => void;
+    /** Overrides the re-mint cadence; must stay under the storefront's code lifetime. */
+    intervalMs?: number;
+};
+/**
+ * Keeps a fresh order-handoff code in the storefront frame for as long as the shopper sits on
+ * the confirm page.
+ *
+ * A code cannot be minted at submit time: minting is a round trip, and awaiting it inside the
+ * click handler outlives the transient user activation the top-level form submit depends on.
+ * Minting once on page load does not work either, since a shopper reading the terms outlives
+ * the code. So mint on a cadence and let the frame hold the newest one.
+ *
+ * Failures are swallowed by design — the frame keeps the previous code, and leaves the form
+ * submitting in-frame if it never received one.
+ */
+export declare const createOrderHandoffRefresher: (options: CreateOrderHandoffRefresherOptions) => {
+    start: () => void;
+    stop: () => void;
+};

package/dist/runtime/app/lib/createOrderHandoffRefresher.js

@@ -0,0 +1,21 @@
+const DEFAULT_INTERVAL_MS = 4e4;
+export const createOrderHandoffRefresher = (options) => {
+  let timer = null;
+  const tick = () => {
+    options.mint().then((code) => {
+      if (code) options.deliver(code);
+    }).catch(() => {
+    });
+  };
+  const stop = () => {
+    if (!timer) return;
+    clearInterval(timer);
+    timer = null;
+  };
+  const start = () => {
+    stop();
+    tick();
+    timer = setInterval(tick, options.intervalMs ?? DEFAULT_INTERVAL_MS);
+  };
+  return { start, stop };
+};

package/dist/runtime/app/lib/parseBridgeMessage.js

@@ -20,7 +20,8 @@ export const parseBridgeMessage = (data) => {
           path: payload.path,
           route: typeof payload.route === "string" ? payload.route : null,
           navigationId: typeof payload.navigationId === "string" ? payload.navigationId : null,
-          salesChannelId: typeof payload.salesChannelId === "string" ? payload.salesChannelId : null
+          salesChannelId: typeof payload.salesChannelId === "string" ? payload.salesChannelId : null,
+          returnFallback: payload.returnFallback === true
         }
       } : null;
     case "laioutr:auth-changed":

package/dist/runtime/app/sections/SectionShopwareCheckout.vue

@@ -16,6 +16,12 @@ export const definition = defineSection({
           name: "finishLink",
           label: "Order Confirmation Page",
           description: "If set, the customer is redirected here after completing an order, with the order id appended as ?order=. If left empty, Shopware\u2019s own order confirmation page is shown inside the checkout frame instead."
+        },
+        {
+          type: "link",
+          name: "checkoutLink",
+          label: "Checkout Page",
+          description: "The page this section sits on. Used to bring the customer back here when a payment fails or is cancelled, so they can choose another method without leaving the site."
         }
       ]
     }
@@ -24,21 +30,53 @@ export const definition = defineSection({
 </script>
 
 <script setup>
-import { defineSection, definitionToProps, linkResolver, navigateTo, refreshNuxtData } from "#imports";
-import { ADOPT_SESSION_ENDPOINT_PATH } from "../../shared/const/checkout";
+import {
+  computed,
+  defineSection,
+  definitionToProps,
+  linkResolver,
+  navigateTo,
+  ref,
+  refreshNuxtData,
+  useRoute
+} from "#imports";
+import { ADOPT_SESSION_ENDPOINT_PATH, RETRY_ORDER_QUERY_KEY } from "../../shared/const/checkout";
 import ShopwareEmbedFrame from "../components/ShopwareEmbedFrame.vue";
 const props = defineProps(definitionToProps(definition));
+const route = useRoute();
+const frame = ref(null);
+const toAbsolute = (path) => import.meta.client ? new URL(path, window.location.origin).href : path;
+const finishUrl = computed(() => props.finishLink ? toAbsolute(linkResolver.resolve(props.finishLink)) : void 0);
+const checkoutUrl = computed(
+  () => props.checkoutLink ? toAbsolute(linkResolver.resolve(props.checkoutLink)) : void 0
+);
+const retryOrderId = computed(() => {
+  const value = route.query[RETRY_ORDER_QUERY_KEY];
+  return typeof value === "string" ? value : void 0;
+});
 const onCheckoutFinish = async (orderId) => {
   if (!props.finishLink) return;
   const path = linkResolver.resolve(props.finishLink);
   await navigateTo({ path, query: { order: orderId } });
 };
 const onAuthChanged = async (payload) => {
-  await $fetch(ADOPT_SESSION_ENDPOINT_PATH, { method: "POST", body: { code: payload.code } });
+  try {
+    await $fetch(ADOPT_SESSION_ENDPOINT_PATH, { method: "POST", body: { code: payload.code } });
+  } catch (cause) {
+    console.warn("[app-shopware] could not adopt the storefront session", cause);
+  }
   await refreshNuxtData();
+  frame.value?.refreshHandoff();
 };
 </script>
 
 <template>
-  <ShopwareEmbedFrame @checkout-finish="onCheckoutFinish" @auth-changed="onAuthChanged" />
+  <ShopwareEmbedFrame
+    ref="frame"
+    :finish-url="finishUrl"
+    :checkout-url="checkoutUrl"
+    :retry-order-id="retryOrderId"
+    @checkout-finish="onCheckoutFinish"
+    @auth-changed="onAuthChanged"
+  />
 </template>

package/dist/runtime/server/const/checkout.d.ts

@@ -1,4 +1,4 @@
-export { ADOPT_SESSION_ENDPOINT_PATH, CHECKOUT_ENDPOINT_PATH } from '../../shared/const/checkout.js';
+export { ADOPT_SESSION_ENDPOINT_PATH, CHECKOUT_ENDPOINT_PATH, CHECKOUT_RETRY_ROUTE, ORDER_HANDOFF_ENDPOINT_PATH, RETRY_FRAME_MARKER_KEY, RETRY_ORDER_QUERY_KEY, } from '../../shared/const/checkout.js';
 /**
  * Internal Shopware route the handoff lands on after the storefront session adopts
  * the cart context. Resolved server-side by the `LaioutrConnector` plugin's

package/dist/runtime/server/const/checkout.js

@@ -1,2 +1,10 @@
-export { ADOPT_SESSION_ENDPOINT_PATH, CHECKOUT_ENDPOINT_PATH } from "../../shared/const/checkout.js";
-export const CHECKOUT_REDIRECT_ROUTE = "frontend.checkout.confirm.page";
+import { CHECKOUT_CONFIRM_ROUTE } from "../../shared/const/checkout.js";
+export {
+  ADOPT_SESSION_ENDPOINT_PATH,
+  CHECKOUT_ENDPOINT_PATH,
+  CHECKOUT_RETRY_ROUTE,
+  ORDER_HANDOFF_ENDPOINT_PATH,
+  RETRY_FRAME_MARKER_KEY,
+  RETRY_ORDER_QUERY_KEY
+} from "../../shared/const/checkout.js";
+export const CHECKOUT_REDIRECT_ROUTE = CHECKOUT_CONFIRM_ROUTE;

package/dist/runtime/server/orchestr/product/base.resolver.js

@@ -40,7 +40,8 @@ export default defineShopwareComponentResolver({
       const response = await fetchAllProducts(context.storefrontClient, {
         productIds: missingIds,
         loadVariants: false,
-        resolveCriteria: context.resolveCriteria
+        resolveCriteria: context.resolveCriteria,
+        maxLimit: context.settings.maxLimit
       });
       loadedVariants.push(...response);
     }

package/dist/runtime/server/orchestr/product/variants.link.js

@@ -6,16 +6,18 @@ export default defineShopwareLink(ProductVariantsLink, async ({ entityIds, conte
   const allVariants = passthrough.get(productVariantsToken) ?? await fetchAllProducts(context.storefrontClient, {
     productIds: entityIds,
     loadVariants: true,
-    resolveCriteria: context.resolveCriteria
+    resolveCriteria: context.resolveCriteria,
+    maxLimit: context.settings.maxLimit
   });
   passthrough.set(productVariantsToken, allVariants);
   return {
     links: entityIds.map((productId) => {
-      const product = allVariants.find((variant) => variant.id === productId);
+      const variants = allVariants.filter((variant) => variant.parentId === productId);
       return {
         sourceId: productId,
-        // A products children are its variants. If it has no children, it is a single variant product.
-        targetIds: product?.children && product?.children.length > 0 ? product?.children.map((child) => child.id) : [productId]
+        // A product's variants are the children this sales channel sells. With none of its own, the
+        // product is its single variant.
+        targetIds: variants.length > 0 ? variants.map((variant) => variant.id) : [productId]
       };
     })
   };

package/dist/runtime/server/orchestr-helper/requestedFields.d.ts

@@ -1,5 +1,3 @@
 import type { ResolveCriteria, ShopwareCriteria } from '../types/criteria.js';
-export declare const resolveProductFields: ({ loadVariants }: {
-    loadVariants: boolean;
-}, resolveCriteria: ResolveCriteria) => Promise<ShopwareCriteria>;
 export declare const resolveProductVariantFields: (resolveCriteria: ResolveCriteria) => Promise<ShopwareCriteria>;
+export declare const resolveProductFields: (resolveCriteria: ResolveCriteria) => Promise<ShopwareCriteria>;

package/dist/runtime/server/orchestr-helper/requestedFields.js

@@ -1,47 +1,5 @@
 import { MediaIncludes } from "../const/includes.js";
 import { mergeIncludes } from "../shopware-helper/criteria.js";
-const addAssociation = (name, add, association = {}) => add ? { [name]: association } : {};
-export const resolveProductFields = async ({ loadVariants }, resolveCriteria) => {
-  const variantFields = loadVariants ? await resolveProductVariantFields(resolveCriteria) : void 0;
-  return resolveCriteria("product", {
-    associations: {
-      cover: { associations: { media: {} } },
-      media: { associations: { media: {} } },
-      ...addAssociation("children", loadVariants, variantFields ? { associations: variantFields.associations } : {})
-    },
-    includes: mergeIncludes(
-      {
-        product: [
-          "id",
-          "parentId",
-          "name",
-          "seoUrls",
-          "productNumber",
-          "ean",
-          "translated",
-          "manufacturer",
-          "description",
-          "cover",
-          "metaTitle",
-          "metaDescription",
-          "cover",
-          "media",
-          "minPurchase",
-          "purchaseSteps",
-          "maxPurchase",
-          "calculatedPrice",
-          "calculatedPrices",
-          "children",
-          "ratingAverage",
-          "productReviews"
-        ],
-        product_media: ["id", "mediaId", "media"],
-        media: MediaIncludes
-      },
-      variantFields?.includes ?? {}
-    )
-  });
-};
 export const resolveProductVariantFields = async (resolveCriteria) => resolveCriteria("product-variant", {
   associations: {
     cover: { associations: { media: {} } },
@@ -86,3 +44,42 @@ export const resolveProductVariantFields = async (resolveCriteria) => resolveCri
     property_group: ["id", "name", "translated"]
   }
 });
+export const resolveProductFields = async (resolveCriteria) => {
+  const variantFields = await resolveProductVariantFields(resolveCriteria);
+  return resolveCriteria("product", {
+    associations: {
+      cover: { associations: { media: {} } },
+      media: { associations: { media: {} } }
+    },
+    includes: mergeIncludes(
+      {
+        product: [
+          "id",
+          "parentId",
+          "name",
+          "seoUrls",
+          "productNumber",
+          "ean",
+          "translated",
+          "manufacturer",
+          "description",
+          "cover",
+          "metaTitle",
+          "metaDescription",
+          "cover",
+          "media",
+          "minPurchase",
+          "purchaseSteps",
+          "maxPurchase",
+          "calculatedPrice",
+          "calculatedPrices",
+          "ratingAverage",
+          "productReviews"
+        ],
+        product_media: ["id", "mediaId", "media"],
+        media: MediaIncludes
+      },
+      variantFields.includes
+    )
+  });
+};

package/dist/runtime/server/routes/checkout.js

@@ -1,5 +1,14 @@
 import { consola } from "consola";
-import { createError, defineEventHandler, getCookie, getRequestURL, sendRedirect, useRuntimeConfig } from "#imports";
+import {
+  createError,
+  defineEventHandler,
+  getCookie,
+  getQuery,
+  getRequestURL,
+  sendRedirect,
+  useRuntimeConfig
+} from "#imports";
+import { RETRY_ORDER_QUERY_KEY } from "../const/checkout.js";
 import { CONTEXT_TOKEN_COOKIE } from "../const/cookieKeys.js";
 import { bootstrapGuestContextToken } from "../shopware-helper/bootstrapContextToken.js";
 import { persistContextToken } from "../shopware-helper/persistContextToken.js";
@@ -17,10 +26,12 @@ export default defineEventHandler(async (event) => {
       log.error("Failed to bootstrap a guest context token", cause);
     }
   }
+  const retryOrderId = getQuery(event)[RETRY_ORDER_QUERY_KEY];
   const plan = await resolveCheckout({
     config,
     contextToken,
     origin: getRequestURL(event).origin,
+    retryOrderId: typeof retryOrderId === "string" ? retryOrderId : null,
     mint: mintSessionHandoffCode
   });
   if (plan.kind === "error") {

package/dist/runtime/server/routes/order-handoff.post.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Mint a single-use session-handoff code for the embedded checkout's top-level order submit.
+ *
+ * The confirm form targets `_top` so redirect-based payment providers are never framed, and
+ * the storefront route it posts to redeems this code to install a session in the top-level
+ * cookie jar before forwarding to Shopware's order endpoint. Codes expire in about a minute,
+ * so the section re-mints while the shopper sits on the confirm page rather than once on load.
+ *
+ * The shopper reaches confirm through the checkout handoff, which bootstraps a context token
+ * when none exists — so a missing cookie here means the session was lost, not that the
+ * shopper is new. Fail rather than mint against a fresh guest cart the order would not match.
+ */
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/order-handoff.post.js

@@ -0,0 +1,33 @@
+import { consola } from "consola";
+import { createError, defineEventHandler, getCookie, getRequestURL, readBody, useRuntimeConfig } from "#imports";
+import { CHECKOUT_REDIRECT_ROUTE } from "../const/checkout.js";
+import { CONTEXT_TOKEN_COOKIE } from "../const/cookieKeys.js";
+import { mintSessionHandoffCode } from "../shopware-helper/sessionHandoff.js";
+const log = consola.withTag("shopware/order-handoff");
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()["@laioutr/app-shopware"];
+  const contextToken = getCookie(event, CONTEXT_TOKEN_COOKIE);
+  if (!contextToken) {
+    throw createError({ statusCode: 409, statusMessage: "No cart context to hand off" });
+  }
+  const origin = getRequestURL(event).origin;
+  const body = await readBody(event).catch(() => ({}));
+  const finishUrl = typeof body?.finishUrl === "string" ? body.finishUrl : void 0;
+  const checkoutUrl = typeof body?.checkoutUrl === "string" ? body.checkoutUrl : void 0;
+  try {
+    const code = await mintSessionHandoffCode({
+      endpoint: config.endpoint,
+      accessToken: config.accessToken,
+      contextToken,
+      loginSuccessCallback: config.checkoutLoginCallbackUrl ?? origin,
+      logoutSuccessCallback: config.checkoutLogoutCallbackUrl ?? origin,
+      redirectRoute: CHECKOUT_REDIRECT_ROUTE,
+      finishSuccessCallback: finishUrl,
+      checkoutCallback: checkoutUrl
+    });
+    return { code };
+  } catch (cause) {
+    log.error("Failed to mint an order handoff code", cause);
+    throw createError({ statusCode: 502, statusMessage: "Order handoff mint failed" });
+  }
+});

package/dist/runtime/server/shopware-helper/fetchAllProductVariants.d.ts

@@ -1,9 +1,10 @@
 import type { ResolveCriteria } from '../types/criteria.js';
 import { StorefrontClient } from '../types/shopware.js';
-export declare const fetchAllProducts: (storefrontClient: StorefrontClient, { productIds, loadVariants, resolveCriteria }: {
+export declare const fetchAllProducts: (storefrontClient: StorefrontClient, { productIds, loadVariants, resolveCriteria, maxLimit, }: {
     productIds: string[];
     loadVariants: boolean;
     resolveCriteria: ResolveCriteria;
+    maxLimit: number;
 }) => Promise<{
     active?: boolean;
     apiAlias: "product";

package/dist/runtime/server/shopware-helper/fetchAllProductVariants.js

@@ -1,17 +1,45 @@
 import { toRequestCriteria } from "./criteria.js";
-import { resolveProductFields } from "../orchestr-helper/requestedFields.js";
-export const fetchAllProducts = async (storefrontClient, { productIds, loadVariants, resolveCriteria }) => {
+import { resolveProductFields, resolveProductVariantFields } from "../orchestr-helper/requestedFields.js";
+const readVariants = async (storefrontClient, { parentIds, resolveCriteria, maxLimit }) => {
+  const criteria = await resolveProductVariantFields(resolveCriteria);
+  const variants = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (let page = 1; ; page++) {
+    const response = await storefrontClient.invoke("readProduct post /product", {
+      body: {
+        page,
+        limit: maxLimit,
+        filter: [{ type: "equalsAny", field: "parentId", value: parentIds }],
+        ...toRequestCriteria(criteria)
+      }
+    });
+    const elements = response.data.elements ?? [];
+    const fresh = elements.filter((element) => element.id && !seen.has(element.id));
+    for (const element of fresh) seen.add(element.id);
+    variants.push(...fresh);
+    if (elements.length < maxLimit || fresh.length === 0) break;
+  }
+  return variants;
+};
+export const fetchAllProducts = async (storefrontClient, {
+  productIds,
+  loadVariants,
+  resolveCriteria,
+  maxLimit
+}) => {
   if (productIds.length === 0) {
     return [];
   }
-  const criteria = await resolveProductFields({ loadVariants }, resolveCriteria);
-  const response = await storefrontClient.invoke("readProduct post /product", {
-    body: {
-      ids: productIds,
-      ...toRequestCriteria(criteria)
-    }
-  });
+  const criteria = await resolveProductFields(resolveCriteria);
+  const [response, variants] = await Promise.all([
+    storefrontClient.invoke("readProduct post /product", {
+      body: {
+        ids: productIds,
+        ...toRequestCriteria(criteria)
+      }
+    }),
+    loadVariants ? readVariants(storefrontClient, { parentIds: productIds, resolveCriteria, maxLimit }) : []
+  ]);
   const products = response.data.elements ?? [];
-  const all = [...products.flatMap((product) => product.children ?? []), ...products];
-  return all;
+  return [...variants, ...products];
 };

package/dist/runtime/server/shopware-helper/resolveCheckout.d.ts

@@ -21,6 +21,8 @@ export interface ResolveCheckoutDeps {
     contextToken: string | null | undefined;
     /** Request origin used for the login/logout success callbacks. */
     origin: string;
+    /** Order to retry payment for, from the storefront's `retry-order` bounce. */
+    retryOrderId?: string | null;
     /** Injected minter (real: {@link mintSessionHandoffCode}) — keeps this decision logic pure/testable. */
     mint: (params: MintSessionHandoffParams) => Promise<string>;
 }

package/dist/runtime/server/shopware-helper/resolveCheckout.js

@@ -1,7 +1,7 @@
 import { buildConnectSessionUrl } from "./checkoutUrl.js";
-import { CHECKOUT_REDIRECT_ROUTE } from "../const/checkout.js";
+import { CHECKOUT_REDIRECT_ROUTE, CHECKOUT_RETRY_ROUTE, RETRY_FRAME_MARKER_KEY } from "../const/checkout.js";
 export const resolveCheckout = async (deps) => {
-  const { config, contextToken, origin, mint } = deps;
+  const { config, contextToken, origin, retryOrderId, mint } = deps;
   if (!contextToken) {
     return { kind: "redirect", url: "/" };
   }
@@ -15,7 +15,8 @@ export const resolveCheckout = async (deps) => {
       contextToken,
       loginSuccessCallback: config.checkoutLoginCallbackUrl ?? origin,
       logoutSuccessCallback: config.checkoutLogoutCallbackUrl ?? origin,
-      redirectRoute: CHECKOUT_REDIRECT_ROUTE
+      redirectRoute: retryOrderId ? CHECKOUT_RETRY_ROUTE : CHECKOUT_REDIRECT_ROUTE,
+      ...retryOrderId ? { redirectRouteParams: { orderId: retryOrderId, [RETRY_FRAME_MARKER_KEY]: "1" } } : {}
     });
     return { kind: "redirect", url: buildConnectSessionUrl({ storefrontUrl: config.storefrontUrl, code }) };
   } catch (cause) {

package/dist/runtime/server/shopware-helper/sessionHandoff.d.ts

@@ -11,6 +11,12 @@ export interface MintSessionHandoffParams {
     logoutSuccessCallback: string;
     /** Internal Shopware route the handoff lands on after redeem. */
     redirectRoute: string;
+    /** Absolute URL of the laioutr page shown after a completed order. */
+    finishSuccessCallback?: string;
+    /** Absolute URL of the laioutr checkout page, used to re-frame a payment retry. */
+    checkoutCallback?: string;
+    /** Parameters for `redirectRoute`; the retry route is keyed by `orderId`. */
+    redirectRouteParams?: Record<string, string>;
 }
 /**
  * Mint a single-use session-handoff code against the `LaioutrConnector` plugin's

package/dist/runtime/server/shopware-helper/sessionHandoff.js

@@ -13,10 +13,15 @@ export const mintSessionHandoffCode = async (params) => {
         "sw-access-key": params.accessToken,
         "sw-context-token": params.contextToken
       },
+      // Undefined keys are omitted rather than sent as null, so a plugin build that predates
+      // the return trip still accepts the call.
       body: {
         "login-success-callback": params.loginSuccessCallback,
         "logout-success-callback": params.logoutSuccessCallback,
-        "redirect-route": params.redirectRoute
+        "redirect-route": params.redirectRoute,
+        ...params.finishSuccessCallback ? { "finish-success-callback": params.finishSuccessCallback } : {},
+        ...params.checkoutCallback ? { "checkout-callback": params.checkoutCallback } : {},
+        ...params.redirectRouteParams ? { "redirect-route-params": params.redirectRouteParams } : {}
       }
     });
   } catch (err) {

package/dist/runtime/shared/const/checkout.d.ts

@@ -16,3 +16,36 @@ export declare const CHECKOUT_ENDPOINT_PATH = "/app-shopware/checkout";
  * `/api/laioutr/*` namespace.
  */
 export declare const ADOPT_SESSION_ENDPOINT_PATH = "/app-shopware/adopt-session";
+/**
+ * Same-origin route the embedded checkout section POSTs to for a fresh single-use handoff
+ * code, which it then hands to the storefront frame.
+ *
+ * The confirm form submits into the top-level window so redirect-based payment providers are
+ * never framed. When the storefront sits on a different registrable domain than laioutr, that
+ * top-level request lands in a cookie jar with no storefront session, so the code travels in
+ * the form and installs one before the order is placed. Minting stays server-side: the raw
+ * `sw-context-token` never reaches the browser.
+ */
+export declare const ORDER_HANDOFF_ENDPOINT_PATH = "/app-shopware/order-handoff";
+/**
+ * Storefront route name of the checkout confirm page.
+ *
+ * The section only keeps a handoff code minted while the frame sits on this page: it is the
+ * only page whose submit needs one, and a code outlives its mint by about a minute.
+ */
+export declare const CHECKOUT_CONFIRM_ROUTE = "frontend.checkout.confirm.page";
+/**
+ * Storefront route that can still take payment for an order whose cart is gone. A cancelled or
+ * declined payment lands here, and the frame is pointed at it so the retry happens in place.
+ */
+export declare const CHECKOUT_RETRY_ROUTE = "frontend.account.edit-order.page";
+/** Query key the storefront uses to hand a failed order back for a retry. */
+export declare const RETRY_ORDER_QUERY_KEY = "retry-order";
+/**
+ * Marks the frame's own navigation to the retry route, so the storefront leaves it in place.
+ *
+ * Without it the storefront cannot tell this apart from a shopper the payment provider bounced
+ * to the same route at top level, and would send the frame back to Laioutr — which points the
+ * frame at the retry again, forever.
+ */
+export declare const RETRY_FRAME_MARKER_KEY = "laioutr-retry";

package/dist/runtime/shared/const/checkout.js

@@ -1,2 +1,7 @@
 export const CHECKOUT_ENDPOINT_PATH = "/app-shopware/checkout";
 export const ADOPT_SESSION_ENDPOINT_PATH = "/app-shopware/adopt-session";
+export const ORDER_HANDOFF_ENDPOINT_PATH = "/app-shopware/order-handoff";
+export const CHECKOUT_CONFIRM_ROUTE = "frontend.checkout.confirm.page";
+export const CHECKOUT_RETRY_ROUTE = "frontend.account.edit-order.page";
+export const RETRY_ORDER_QUERY_KEY = "retry-order";
+export const RETRY_FRAME_MARKER_KEY = "laioutr-retry";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@laioutr/app-shopware",
-  "version": "0.15.4",
+  "version": "0.16.0",
   "description": "Laioutr integration with Shopware 6",
   "repository": "github:laioutr/app-shopware",
   "license": "MIT",